WO2015192562A1 - 通信系统、基于通信系统的接入认证方法及系统 - Google Patents

通信系统、基于通信系统的接入认证方法及系统 Download PDF

Info

Publication number
WO2015192562A1
WO2015192562A1 PCT/CN2014/088868 CN2014088868W WO2015192562A1 WO 2015192562 A1 WO2015192562 A1 WO 2015192562A1 CN 2014088868 W CN2014088868 W CN 2014088868W WO 2015192562 A1 WO2015192562 A1 WO 2015192562A1
Authority
WO
WIPO (PCT)
Prior art keywords
function entity
service
access control
control function
user context
Prior art date
Application number
PCT/CN2014/088868
Other languages
English (en)
French (fr)
Inventor
陶峑郡
田甜
吴瑟
朱进国
谢宝国
赵文贤
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US15/319,930 priority Critical patent/US10623405B2/en
Priority to EP14895450.6A priority patent/EP3160190B1/en
Publication of WO2015192562A1 publication Critical patent/WO2015192562A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90—Details of database functions independent of the retrieved data types
    • G06F16/95—Retrieval from the web
    • G06F16/955—Retrieval from the web using information identifiers, e.g. uniform resource locators [URL]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0876—Network architectures or network communication protocols for network security for authentication of entities based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H04W12/084—Access security using delegated authorisation, e.g. open authorisation [OAuth] protocol
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/02—Access restriction performed under specific conditions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W48/00—Access restriction; Network selection; Access point selection
    • H04W48/16—Discovering, processing access restriction or access information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/04—Large scale networks; Deep hierarchical networks
    • H04W84/042—Public Land Mobile systems, e.g. cellular systems
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices

Definitions

  • the present invention relates to the field of communications, and in particular to a communication system, a communication system based access authentication method and system.
  • the fifth-generation mobile communication technology (5G) mobile broadband system will become a wireless mobile communication system for the human information society after 2020. It is a multi-service and multi-technology convergence network. Through the evolution and innovation of technology, it will meet the future wide range. The ever-evolving needs of data and connected services enhance the user experience.
  • 5G fifth-generation mobile communication technology
  • Wireless mobile communication technology and computer and information technology will be more closely and deeper cross-integration, integrated circuits, device technology, software technology, etc. will continue to develop rapidly, supporting the future development of 5G mobile broadband industry.
  • 5G networks need to provide users with an on-line experience and meet more high-value scenarios such as industrial control and emergency communications.
  • it is required to further reduce the user plane delay and control plane delay, which is 5-10 times shorter than 4G, reaching the limit of human response, for example: 5ms (tactile response), and providing a true always-on experience.
  • 5ms tacile response
  • FIG. 1 is a schematic diagram of a network architecture of a fourth generation mobile communication technology (4G) evolved packet core network (EPC) according to the related art.
  • the network architecture can include the following components:
  • E-UTRAN Terrestrial Radio Access Network
  • the Mobility Management Entity is responsible for control plane mobility management, which may include, but is not limited to, user context and mobility state management, and allocation of user temporary identity identifiers;
  • a service gateway entity (Server-Single Gateway, S-GW for short), which is a user plane entity and is responsible for user plane data routing processing;
  • PPP packet data network gateway
  • P-GW packet data network gateway
  • the P-GW and the S-GW may be combined in one physical entity.
  • SGSN Serving GPRS Supporting Node
  • PCRF Policy and Charging Rule Function
  • a Home Subsriber Server (HSS) is set to store user subscription information.
  • the above network architecture mainly has the following defects:
  • each network element in the existing architecture model adopts a tunnel-based connection technology, and thus is not conducive to distributed dynamic management.
  • the present invention provides a communication system, a communication system-based access authentication method, and a system, to at least solve the problem that the access authentication method provided in the related art is complicated and the processing delay is high.
  • a communication system is provided.
  • the method includes: a context generation function entity configured to generate a user context, and storing the generated user context in a context database matching the context generation function entity; the service access control function entity, configured to obtain from the context database User context, and the user context is used to authenticate the terminal that initiated the access request.
  • the above system further comprises: a service data source function entity, configured to provide a data source for generating a user context for the context generation function entity.
  • a service data source function entity configured to provide a data source for generating a user context for the context generation function entity.
  • the system further includes: a service processing function entity; the service access control function entity is further configured to identify the service request initiated by the terminal, allow the terminal to send the service data, and forward the service data received from the terminal to the service.
  • an access authentication method based on the above communication system is provided.
  • the access authentication method includes: the service access control function entity receives an access request message from the terminal, where the access request message carries the identity identification information of the terminal user; the service access control function entity The user context is obtained according to the identity information, and the terminal is authenticated by using the user context.
  • the service access control function entity acquires the user context, and the service access control function entity sends a request message for acquiring the user context to the context database, where the request message carries the identity identification information; the service access control function entity receives the The response message of the context database, wherein the response message carries a user context corresponding to the identity information.
  • the method further includes: the context database determining the service access control function entity to be accessed by the terminal adjacent to the service access control function entity; the context database The user context is sent to the adjacent service access control function entity.
  • the service access control function entity acquires the user context, and the service access control function entity sends one or more service access control function entities and context data adjacent to the service access control function entity.
  • the server sends a request message for acquiring a user context, where the request message carries the identity information, and the service access control function entity stores the user context corresponding to the identity information carried in the first received response message, and Discard the user context carried in the remaining response messages.
  • the service access control function entity acquires the user context, and the service access control function entity sends a request message for acquiring the user context to the context database, where the request message carries the identity identification information, and the user context storage is found in the context database.
  • the request message is forwarded by the context database to the adjacent service access control function entity; the service access control function entity receives the function from the adjacent service access control function entity The response message, wherein the response message carries a user context corresponding to the identity information.
  • the service access control function entity uses the user context to perform access authentication on the terminal, and the service access control function entity uses the user context to determine whether to allow the terminal to access; if yes, the service access control function entity returns to the terminal. Incoming reply message.
  • the method further includes: the service access control function entity receiving an update request message from the context database, where the update request message is used for the user context The update is performed; the service access control function entity forwards the update request message to the neighbor service access control function entity that has acquired the user context from the service access control function entity.
  • the service access control function entity determines whether the terminal is currently in an inactive state and the duration of the inactive state has exceeded a preset threshold; , the user context is directly deleted; if not, the user context is updated according to the update request message.
  • the method further includes: the service access control function entity receiving the service request message from the terminal; and the service access control function entity performing the service request message Identifying, and selecting a service processing function entity for the terminal as the terminal according to the user context and the terminal capability information.
  • the method further includes: the service access control function entity receives the service data packet from the terminal, and inserts the user context into the service data packet; The access control function entity sends the service data message to the service processing function entity.
  • the method further includes: the service processing function entity extracts the user context from the service data packet; the service processing function entity adopts the user context and the preset The business processing logic performs business processing on the service data packets.
  • the method further includes: the service access control function entity receiving the service request message from the terminal; and the service access control function entity performing the service request message Identifying, and selecting, according to the user context and the terminal capability information, a service processing function entity that is a terminal service for the terminal; the service access control function entity sends the user context to the service processing function entity.
  • the method further includes: the service access control function entity receives the service data packet from the terminal, and inserts the user context into the service data packet. Correlation information; the service access control function entity sends the service data message to the service processing function entity.
  • the method further includes: the service processing function entity extracts the association information from the service data packet; the service processing function entity acquires the context information according to the association information.
  • the service processing function entity performs business processing on the service data packet by using the user context and the preset service processing logic.
  • the method further includes: the service access control function entity receives the service data packet from the terminal, and inserts the association of the user context in the service data packet.
  • the service access control function entity sends the service data message to the service processing function entity.
  • the method further includes: the service processing function entity extracts the association information from the service data packet; the service processing function entity obtains the association information according to the association information.
  • the user context is obtained; the service processing function entity performs service processing on the service data packet by using the user context and the preset service processing logic.
  • the method further includes: the service access control function entity is no longer determined to perform service processing on the service data packet by the service processing function entity, and is no longer The service data packet is forwarded through the service processing function entity.
  • an access authentication system based on the above communication system is provided.
  • the access authentication method system includes: a service access control function entity; the service access control function entity includes: a first receiving module, configured to receive an access request message from the terminal, where the access The request message carries the identity information of the terminal user; the authentication module is configured to acquire the user context according to the identity identification information, and perform access authentication on the terminal by using the user context.
  • the authentication module includes: a first sending unit, configured to send a request message for acquiring a user context to the context database, wherein the request message carries the identity identification information; and the first receiving unit is configured to receive the response from the context database.
  • the message, wherein the response message carries a user context corresponding to the identity information.
  • the system further includes: a context database;
  • the context database includes: a determining module, configured to determine a service access control function entity that is to be accessed by the terminal and adjacent to the service access control function entity; the first sending module, setting To send the user context to the adjacent service access control function entity.
  • the authentication module includes: a second sending unit, configured to separately send a request message for acquiring a user context to one or more service access control function entities and a context database adjacent to the service access control function entity, wherein the request The message carries the identity information.
  • the processing unit is configured to store the user context corresponding to the identity information carried in the first received response message, and discard the user context carried in the remaining response messages.
  • the authentication module includes: a third sending unit, configured to send a request message for acquiring a user context to the context database, where the request message carries the identity identification information, and the context database is found to be stored in the adjacent service connection in the context database.
  • the request message is forwarded by the context database to the adjacent service access control function entity; the second receiving unit is configured to receive the response message from the adjacent service access control function entity, wherein The response message carries a user context corresponding to the identity information.
  • the authentication module includes: a determining unit, configured to determine whether the terminal is allowed to access by using a user context; and the feedback unit is configured to return an access response message to the terminal when the output of the determining unit is YES.
  • the service access control function entity further includes: a second receiving module, configured to receive an update request message from the context database, wherein the update request message is used to update the user context; and the forwarding module is configured to send the update request The message is forwarded to a neighboring service access control function entity that has obtained a user context from the service access control function entity.
  • a second receiving module configured to receive an update request message from the context database, wherein the update request message is used to update the user context
  • the forwarding module is configured to send the update request The message is forwarded to a neighboring service access control function entity that has obtained a user context from the service access control function entity.
  • the service access control function entity further includes: a determining module, configured to determine whether the terminal is currently in an inactive state and the duration of the inactive state has exceeded a preset threshold; deleting the module, setting the output of the determining module to be The user context is directly deleted; the update module is set to update the user context according to the update request message when the judgment module output is no.
  • a determining module configured to determine whether the terminal is currently in an inactive state and the duration of the inactive state has exceeded a preset threshold
  • deleting the module setting the output of the determining module to be The user context is directly deleted
  • the update module is set to update the user context according to the update request message when the judgment module output is no.
  • the service access control function entity further includes: a third receiving module, configured to receive a service request message from the terminal; the first identifying module is configured to identify the service request message, and according to the user context and the terminal capability information A service processing function entity selected as a terminal service for the terminal.
  • the service access control function entity further includes: a fourth receiving module, configured to receive a service data packet from the terminal, and insert a user context into the service data packet; and the second sending module is configured to set the service data The message is sent to the business processing function entity.
  • a fourth receiving module configured to receive a service data packet from the terminal, and insert a user context into the service data packet
  • the second sending module is configured to set the service data The message is sent to the business processing function entity.
  • the system further includes: a service processing function entity;
  • the service processing function entity includes: a first extraction module, configured to extract a user context from the service data packet; and the first processing module is configured to adopt a user context and a preset
  • the service processing logic performs business processing on service data packets.
  • the service access control function entity further includes: a fifth receiving module, configured to receive a service request message from the terminal; and a second identifying module configured to identify the service request message, and according to the user context and the terminal capability information A service processing function entity selected as a terminal service is selected for the terminal; and a third sending module is configured to send the user context to the service processing function entity.
  • a fifth receiving module configured to receive a service request message from the terminal
  • a second identifying module configured to identify the service request message, and according to the user context and the terminal capability information
  • a service processing function entity selected as a terminal service is selected for the terminal
  • a third sending module is configured to send the user context to the service processing function entity.
  • the service access control function entity further includes: a sixth receiving module, configured to receive the service data packet from the terminal, and insert the association information of the user context in the service data packet; the fourth sending module is set to Send the service data packet to the service processing function entity.
  • the service processing function entity further includes: a second extraction module, configured to extract association information from the service data packet; the first acquisition module is configured to acquire context information according to the association information; and the second processing module is configured to adopt the user The context and the preset business processing logic perform business processing on the service data packet.
  • a second extraction module configured to extract association information from the service data packet
  • the first acquisition module is configured to acquire context information according to the association information
  • the second processing module is configured to adopt the user The context and the preset business processing logic perform business processing on the service data packet.
  • the service access control function entity further includes: a seventh receiving module, configured to receive the service data packet from the terminal, and insert the association information of the user context in the service data packet; the fifth sending module is set to Send the service data packet to the service processing function entity.
  • the service processing function entity further includes: a third extraction module, configured to extract the association information from the service data packet; the second acquisition module is configured to acquire the user context from the context database according to the association information; and the third processing module sets Service processing of service data packets is performed by using user context and preset service processing logic.
  • a third extraction module configured to extract the association information from the service data packet
  • the second acquisition module is configured to acquire the user context from the context database according to the association information
  • the third processing module sets Service processing of service data packets is performed by using user context and preset service processing logic.
  • the service access control function entity further includes: a fourth processing module, configured to no longer use the service processing function entity to report the service data in the case that it is determined that the service processing function entity does not need to perform service processing on the service data packet The text is forwarded.
  • a fourth processing module configured to no longer use the service processing function entity to report the service data in the case that it is determined that the service processing function entity does not need to perform service processing on the service data packet The text is forwarded.
  • the context generation function entity is configured to generate a user context, and the generated user context is stored in a context database matching the context generation function entity; the service access control function entity is configured to acquire the user from the context database.
  • Context, and the user context is used to authenticate the terminal that initiates the access request, which solves the problem that the access authentication method provided in the related art is complicated and the processing delay is high, thereby achieving a simple access authentication mode and access time. Delay the effect.
  • FIG. 1 is a schematic diagram of a network architecture of a 4G EPC according to the related art
  • FIG. 2 is a block diagram showing the structure of a communication system according to an embodiment of the present invention.
  • FIG. 3 is a block diagram showing the structure of a communication system according to an embodiment of the present invention.
  • FIG. 4 is a schematic diagram of a communication system in accordance with a preferred embodiment of the present invention.
  • FIG. 5 is a schematic structural diagram of a service data source functional entity according to a preferred embodiment of the present invention.
  • FIG. 6 is a structural block diagram of a service access control function entity in accordance with a preferred embodiment of the present invention.
  • FIG. 7 is a flowchart of a communication system based access authentication method according to an embodiment of the present invention.
  • FIG. 8 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment of the present invention
  • FIG. 9 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment of the present invention
  • FIG. 10 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment of the present invention
  • FIG. 11 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment 4 of the present invention
  • FIG. 12 is a flow chart of a method for user context data or file change in accordance with a preferred embodiment of the present invention.
  • FIG. 13 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment of the present invention
  • FIG. 14 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment 2 of the present invention
  • 15 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment 3 of the present invention
  • 16 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment 4 of the present invention
  • FIG. 17 is a structural block diagram of a communication system based access authentication system according to an embodiment of the present invention.
  • FIG. 18 is a structural block diagram of a communication system based access authentication system in accordance with a preferred embodiment of the present invention.
  • the communication system may include: a context generation function entity 10 configured to generate a user context, and store the generated user context in a context database matching the context generation function entity; the service access control function entity 20, Set to obtain the user context from the context database and authenticate the terminal that initiated the access request with the user context.
  • a context generation function entity 10 configured to generate a user context, and store the generated user context in a context database matching the context generation function entity
  • the service access control function entity 20 Set to obtain the user context from the context database and authenticate the terminal that initiated the access request with the user context.
  • the access authentication method provided in the related art is complicated and the processing delay is high.
  • the system shown in FIG. 2 is used, and the MME in the existing EPC architecture is no longer used for service access control, but the service generation authentication is performed by combining the context generation function entity with the service access control function entity. . Therefore, the problem that the access authentication method provided in the related art is complicated and the processing delay is high is solved, thereby achieving the effects of simple access authentication mode and low access delay.
  • the above system may further include: a service data source function entity 30 configured to provide a data source for generating a user context for the context generation function entity.
  • a service data source function entity 30 configured to provide a data source for generating a user context for the context generation function entity.
  • the system may further include: a service processing function entity 40; the service access control function entity is further configured to identify a service request initiated by the terminal, and allow the terminal to send service data, And forwarding the service data received from the terminal to the service processing function entity; the service processing function entity is configured to perform service processing on the service data.
  • a service processing function entity 40 the service access control function entity is further configured to identify a service request initiated by the terminal, and allow the terminal to send service data, And forwarding the service data received from the terminal to the service processing function entity; the service processing function entity is configured to perform service processing on the service data.
  • FIG. 4 is a schematic diagram of a communication system in accordance with a preferred embodiment of the present invention.
  • the communication system may include: a service data source function entity, a context generation function entity and a context database, a service access control function entity, and a service processing function entity.
  • the specific functions that each functional entity can achieve are as follows:
  • FIG. 5 is a schematic structural diagram of a service data source functional entity according to a preferred embodiment of the present invention.
  • the service data source function entity may include, but is not limited to, a telecommunication network element user home server, an authentication, an accounting, and an accounting server (Authentication, Accounting, Authorization Server, AAA for short), and a service orchestration server (Service). Orchestrator), Account Center, Big-Data Analysis, and Third-Party Mgmt.
  • the context generation function entity and the context database are mainly responsible for collecting and summarizing the business data source data related to the user, and converting and generating the context data format or file based on the user and understood by the business.
  • the user terminal accesses the network, it is responsible for pushing the user context data or file to the user access or the neighboring service access control function entity, where the user context may include but not limited to the following information:
  • QoS information of the user's quality of service for example: guaranteed bandwidth subscribed by the user, maximum and minimum bandwidth information
  • User level information for example: user priority information
  • FIG. 6 is a structural block diagram of a service access control function entity in accordance with a preferred embodiment of the present invention.
  • the service access control function entity may include: an access control management module, It is configured to control, authenticate, and authorize the user terminal access and the service request according to the user context; the service identification module is configured to identify the service initiated by the user; and the service offloading module is set to be based on the user context information and the user terminal capability information.
  • the user terminal selects a service processing function entity of the service; the media processing module is configured to convert the format of the forwarding plane data packet initiated by the user terminal, for example, inserting user context related information and the like.
  • the service processing function entity is responsible for performing service processing on the received data packet according to the user context information notified by the service access control function entity and the preset service processing logic.
  • FIG. 7 is a flow chart of a communication system based access authentication method in accordance with an embodiment of the present invention. As shown in FIG. 7, the method may include the following processing steps:
  • Step S702 The service access control function entity receives an access request message from the terminal, where the access request message carries the identity identification information of the terminal user.
  • Step S704 The service access control function entity acquires the user context according to the identity identification information, and performs access authentication on the terminal by using the user context.
  • the service access control function entity acquiring the user context may include the following operations:
  • Step S1 The service access control function entity sends a request message for acquiring a user context to the context database, where the request message carries the identity identification information;
  • Step S2 The service access control function entity receives a response message from the context database, where the response message carries a user context corresponding to the identity identification information.
  • FIG. 8 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment of the present invention. As shown in FIG. 8, the process may include the following processing steps:
  • Step S802 The terminal sends an access request message to the service access control function entity, where the access request message carries user identity information.
  • Step S804 The service access control function entity checks whether there is valid user context data or file, and the context validity may be determined according to a validity state carried in the context, such as a context effective life cycle or other state information. If yes, go directly to step S810;
  • Step S806 If it is found that there is no valid context, the service access control function entity sends a request message for acquiring the user context to the context database, where the request message carries the user identity information;
  • Step S808 The context database records the address information of the service access control function entity of the context, and returns the user context to the service access control function entity by inserting the user context message;
  • Step S810 The service access control function entity may authenticate the access of the user terminal according to the uplink information of the user, and if the user terminal is allowed to access, return an access response to the terminal.
  • the service access control function entity may further include the following steps in step S2:
  • Step S3 The context database determines a service access control function entity that is to be accessed by the terminal and is adjacent to the service access control function entity;
  • Step S4 The context database sends the user context to the adjacent service access control function entity.
  • FIG. 9 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment of the present invention. As shown in FIG. 9, the process may include the following processing steps:
  • Step S902 The terminal sends an access request message to the service access control function entity, where the access request message carries user identity information.
  • Step S904 The service access control function entity checks whether there is valid user context data or file, and the context validity may be determined according to a validity state carried in the context, such as a context effective life cycle or other state information. If yes, go directly to step S910;
  • Step S906 If it is found that there is no valid context, the service access control function entity sends a request message for acquiring the user context to the context database, where the request message carries the user identity information;
  • Step S908 The context database records the address information of the service access control function entity of the context, and returns the user context to the service access control function entity by inserting the user context message;
  • Step S910 The service access control function entity can authenticate the access of the user terminal according to the uplink information of the user, and if the user terminal is allowed to access, return an access response to the terminal.
  • Step S912 The context database senses the user behavior characteristic. If the user is found to belong to the high mobility terminal, or other factors, the context database decides to actively push the user's context data or file to the adjacent service access control function entity accessed by the user, so that When the user moves to the adjacent service access control function entity, the service access control function entity does not need to obtain the context from the context database.
  • Step S914 The context database notifies and pushes the user context data or file to the adjacent service access control function entity, and the service access control function entity saves the context.
  • the service access control function entity acquiring the user context may include the following operations:
  • Step S5 The service access control function entity sends a request message for acquiring a user context to one or more service access control function entities and a context database adjacent to the service access control function entity, where the request message carries Identification information;
  • Step S6 The service access control function entity stores the user context corresponding to the identity identification information carried in the first received response message, and discards the user context carried in the remaining response messages.
  • FIG. 10 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment 3 of the present invention. As shown in FIG. 10, the process may include the following processing steps:
  • Step S1002 The terminal sends an access request message to the service access control function entity 1, where the access request message carries user identity information.
  • Step S1004 The service access control function entity 1 checks whether there is valid user context data or file, if it exists, then proceeds directly to step S1016;
  • Step S1006a-Step S1006c In order to improve the speed at which the service access control function entity 1 acquires the user context, the service access control function entity 1 simultaneously transmits the acquisition to the adjacent service access control function entity 2 and the adjacent service access control function entity 3. a context request and simultaneously send a get context request to the context database;
  • Step S1008 After receiving the request message, the neighboring service access control function entity 2 determines that the valid context of the user exists, and returns the user context data or file to the service access control function entity 1; the service access control function entity 1 saves The context information received first;
  • Step S1010 After receiving the request message, the neighboring service access control function entity 3 determines that there is no valid context of the user, and discards the request message.
  • Step S1012 After receiving the request message, the context database also returns a user context to the service access control function entity 1;
  • Step S1014 After receiving the context information returned by the context database, the service access control function entity 1 determines that the context information has been acquired, and then discards the context information.
  • Step S1016 The service access control function entity 1 can authenticate the access of the user terminal according to the uplink information of the user, and if the user terminal is allowed to access, return an access response to the terminal.
  • the service access control function entity acquiring the user context may include the following steps:
  • Step S7 The service access control function entity sends a request message for acquiring a user context to the context database, where the request message carries the identity identification information, and the context database is found to be stored in the adjacent service access control function entity. In case, the request message is forwarded by the context database to the adjacent service access control function entity;
  • Step S8 The service access control function entity receives a response message from the neighboring service access control function entity, where the response message carries a user context corresponding to the identity identification information.
  • FIG. 11 is a flowchart of a method for a service access control function entity to acquire a user context when a user terminal accesses a network according to a preferred embodiment 4 of the present invention. As shown in FIG. 11, the process may include the following processing steps:
  • Step S1102 The terminal sends an access request message to the service access control function entity, where the access request message carries the user identity information.
  • Step S1104 The service access control function entity checks whether there is valid user context data or file, if yes, then proceeds directly to step S1114;
  • Step S1106 If it is found that there is no valid context, the service access control function entity sends a request message for acquiring the user context to the context database, where the request message carries the user identity information;
  • Step S1108 The context database discovers that the user context requested by the service access control function entity exists in its adjacent service access control function entity;
  • Step S1110 The context database redirects (or redirects) the request message to the adjacent service access control function entity;
  • Step S1112 After receiving the request message, the adjacency service access control function entity determines that the valid context of the user exists, and returns user context data or file to the service access control function entity, and then stores by the service access control function entity. Received user context information;
  • Step S1114 The service access control function entity may authenticate the access of the user terminal according to the uplink information of the user, and if the user terminal is allowed to access, return an access response to the terminal.
  • step S704 the service access control function entity uses the user context to perform access authentication on the terminal, which may include the following operations:
  • Step S9 The service access control function entity uses the user context to determine whether to allow the terminal to access;
  • Step S10 If yes, the service access control function entity returns an access response message to the terminal.
  • the service access control function entity may further include the following operations:
  • Step S11 The service access control function entity receives an update request message from a context database, where the update request message is used to update the user context;
  • Step S12 The service access control function entity forwards the update request message to the neighbor service access control function entity that has acquired the user context from the service access control function entity.
  • the method further includes the following steps:
  • Step S13 The service access control function entity determines whether the terminal is in an inactive state and the duration of the inactive state has exceeded a preset threshold.
  • Step S14 If yes, the user context is directly deleted
  • Step S15 If no, the user context is updated according to the update request message.
  • FIG. 12 is a flow diagram of a method of user context data or file change in accordance with a preferred embodiment of the present invention. As shown in FIG. 12, the method may include the following processing steps:
  • Step S1202 The context database senses that the user context has changed or has expired
  • Step S1204 The context database obtains the address information of the service access control function entity of the user context according to the record, and then sends an update context request message to the service access control function entity, where the update context request message can carry the latest user context. ;
  • Step S1206 The service access control function entity discovers that the adjacency service access control function entity has also obtained the user context from it;
  • Step S1208 The service access control function entity sends an update context request message to the adjacent service access control function entity.
  • Step S1210 The service access control function entity checks that the user terminal corresponding to the user context is in an inactive state, and deletes the user terminal if the inactivity time of the service access control function entity exceeds a preset threshold. User context; otherwise proceed to step S1212;
  • Step S1212 The service access control function entity updates the user context of the context database.
  • step S1212 is an optional step. If the user context is already included in the step S1204 or the context database indicates that the context is invalid, step S1212 is no longer needed.
  • the method further includes the following steps:
  • Step S16 The service access control function entity receives a service request message from the terminal.
  • Step S17 The service access control function entity identifies the service request message, and selects a service processing function entity that is a terminal service for the terminal according to the user context and the terminal capability information.
  • the service access control function entity may further include the following operations:
  • Step S18 The service access control function entity receives the service data packet from the terminal, and inserts the user context into the service data packet.
  • Step S19 The service access control function entity sends the service data packet to the service processing function entity.
  • the service access control function entity may further include the following steps:
  • Step S20 The service processing function entity extracts a user context from the service data packet.
  • Step S21 The service processing function entity performs service processing on the service data packet by using the user context and the preset service processing logic.
  • FIG. 13 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment of the present invention. As shown in FIG. 13, the process may include the following processing steps:
  • Step S1302 The terminal initiates a service request message, where the service request message carries the identity of the user, the type of service initiated, and the like;
  • Step S1304 The service access control function entity performs authentication and authorization on the service initiated by the user terminal.
  • Step S1306 The service access control function entity identifies the service initiated by the user, and selects a service processing function entity that serves the current service of the user according to the subscription information and the terminal capability information in the user context.
  • Step S1308 After the service access control function entity authenticates the service request of the user, the service request response message is returned to the user terminal.
  • Step S1310 The user terminal sends a service data packet to the network.
  • Step S1312 The service access control function entity inserts context information corresponding to the user in the received service data packet.
  • Step S1314 The service access control function entity forwards the service data packet to the selected service processing function entity.
  • Step S1316 The service processing function entity acquires the user context information inserted in the service data packet, and performs service processing on the received service data packet according to the preset service processing logic.
  • Step S1318 The service processing function entity forwards the processed service data packet to the next hop.
  • the service access control function entity may further include the following operations:
  • Step S22 The service access control function entity receives a service request message from the terminal.
  • Step S23 The service access control function entity identifies the service request message, and selects a service processing function entity that is a terminal service for the terminal according to the user context and the terminal capability information;
  • Step S24 The service access control function entity sends the user context to the service processing function entity.
  • the service access control function entity may further include the following operations:
  • Step S25 The service access control function entity receives the service data packet from the terminal, and inserts the association information of the user context in the service data packet.
  • Step S26 The service access control function entity sends the service data packet to the service processing function entity.
  • the service access control function entity may further include the following steps:
  • Step S27 The service processing function entity extracts the association information from the service data packet.
  • Step S28 The service processing function entity acquires context information according to the association information.
  • Step S29 The service processing function entity performs service processing on the service data packet by using the user context and the preset service processing logic.
  • FIG. 14 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment 2 of the present invention. As shown in FIG. 14, the process may include the following processing steps:
  • Step S1402 The terminal initiates a service request message, where the service request message carries information such as the identity of the user, the type of service initiated, and the like;
  • Step S1404 The service access control function entity performs authentication and authorization on the service initiated by the user terminal.
  • Step S1406 The service access control function entity identifies the service initiated by the user, and selects a service processing function entity that serves the current service of the user according to the subscription information and the terminal capability information in the user context.
  • Step S1408 After the service access control function entity authenticates the service request of the user, the service request response message is returned to the user terminal.
  • Step S1410 The service access control function entity passes the user context information to its selected service processing function entity;
  • Step S1412 The user terminal sends a service data packet to the network.
  • Step S1414 The service access control function entity inserts context association information corresponding to the user, for example, context identification information, in the received service data packet.
  • Step S1416 The service access control function entity forwards the service data packet to the selected service processing function entity.
  • Step S1418 The service processing function entity acquires user context association information in the service data packet, and associates the user context information that has been obtained according to the user context association information, and then receives the received service data according to the preset service processing logic. Packet processing for business;
  • Step S1420 The service processing function entity forwards the processed service data packet to the next hop.
  • the method further includes the following steps:
  • Step S30 The service access control function entity receives the service data packet from the terminal, and inserts the association information of the user context in the service data packet.
  • Step S31 The service access control function entity sends the service data packet to the service processing function entity.
  • the service access control function entity may further include the following operations:
  • Step S32 The service processing function entity extracts the association information from the service data packet.
  • Step S33 The service processing function entity acquires a user context from the context database according to the association information.
  • Step S34 The service processing function entity performs service processing on the service data packet by using the user context and the preset service processing logic.
  • FIG. 15 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment 3 of the present invention. As shown in FIG. 15, the process may include the following processing steps:
  • Step S1502 The terminal initiates a service request message, where the service request message carries information such as the identity of the user, the type of service initiated, and the like.
  • Step S1504 The service access control function entity performs authentication and authorization on the service initiated by the user terminal.
  • Step S1506 The service access control function entity identifies the service initiated by the user, and selects a service processing function entity that serves the current service of the user according to the subscription information and the terminal capability information in the user context.
  • Step S1508 After the service access control function entity authenticates the service request of the user, the service request response message is returned to the user terminal.
  • Step S1510 The user terminal sends a service data packet to the network.
  • Step S1512 The service access control function entity inserts context association information corresponding to the user, for example, context identification information, in the received service data packet.
  • Step S1514 The service access control function entity forwards the service data packet to the selected service processing function entity.
  • Step S1516 The service processing function entity acquires user context information from the context database according to the context association information carried in the service data packet.
  • Step S1518 The service processing function entity performs service processing on the received service data packet according to the preset service processing logic.
  • Step S1520 The service processing function entity forwards the processed service data packet to the next hop.
  • the method further includes the following steps:
  • Step S35 The service access control function entity no longer forwards the service data packet via the service processing function entity when it is determined that the service processing function entity does not need to perform service processing on the service data packet.
  • FIG. 16 is a flowchart of performing service processing when a user terminal initiates a service according to a preferred embodiment 4 of the present invention. As shown in FIG. 16, the process may include the following processing steps:
  • Step S1602 The terminal initiates a service request message, where the service request message carries information such as the identity of the user, the type of service initiated, and the like.
  • Step S1604 The service access control function entity performs authentication and authorization on the service initiated by the user terminal.
  • Step S1606 The service access control function entity identifies the service initiated by the user, and selects a service processing function entity that serves the current service of the user according to the subscription information and the terminal capability information in the user context;
  • the service access control function entity discovers that the service currently initiated by the user does not need to be processed by the service processing function entity;
  • Step S1608 After the service access control function entity authenticates the service request of the user, the service request response message is returned to the user terminal.
  • Step S1610 The user terminal sends a service data packet to the network.
  • Step S1612 The service access control function entity considers that the service processing function entity is not required to process the service data packet received by the service access control function entity, and then forwards the service data packet to the Internet or the destination server.
  • the access authentication system may include: a service access control function entity 1;
  • the body 1 may include: a first receiving module 100, configured to receive an access request message from the terminal, where the access request message carries identity information of the terminal user; and the authentication module 102 is configured to obtain according to the identity identification information.
  • User context, and user authentication is used to authenticate the terminal.
  • the authentication module 102 may include: a first sending unit (not shown) configured to send a request message for acquiring a user context to the context database, where the request message carries the identity identification information; the first receiving unit ( Not shown in the figure, is set to receive a response message from the context database, wherein the response message carries a user context corresponding to the identity information.
  • the above system may further include: a context database 2; the context database 2 may include: a determining module 200 configured to determine a service connection to be accessed by the terminal adjacent to the service access control function entity The control function entity; the first sending module 202 is configured to send the user context to the adjacent service access control function entity.
  • a context database 2 may include: a determining module 200 configured to determine a service connection to be accessed by the terminal adjacent to the service access control function entity The control function entity; the first sending module 202 is configured to send the user context to the adjacent service access control function entity.
  • the authentication module 102 may include: a second sending unit (not shown) configured to separately send and obtain to one or more service access control function entities and a context database adjacent to the service access control function entity. a user context request message, wherein the request message carries the identity identification information; the processing unit (not shown) is configured to store the user context corresponding to the identity identification information carried in the first received response message. And discard the user context carried in the remaining response messages.
  • a second sending unit (not shown) configured to separately send and obtain to one or more service access control function entities and a context database adjacent to the service access control function entity.
  • a user context request message wherein the request message carries the identity identification information
  • the processing unit (not shown) is configured to store the user context corresponding to the identity identification information carried in the first received response message. And discard the user context carried in the remaining response messages.
  • the authentication module 102 may include: a third sending unit (not shown) configured to send a request message for acquiring a user context to the context database, where the request message carries the identity identification information and is found in the context database. If the user context is stored in the adjacent service access control function entity, the request message is forwarded by the context database to the adjacent service access control function entity; the second receiving unit (not shown) is configured to receive from the The response message of the neighboring service access control function entity, where the response message carries a user context corresponding to the identity identification information.
  • a third sending unit (not shown) configured to send a request message for acquiring a user context to the context database, where the request message carries the identity identification information and is found in the context database. If the user context is stored in the adjacent service access control function entity, the request message is forwarded by the context database to the adjacent service access control function entity; the second receiving unit (not shown) is configured to receive from the The response message of the neighboring service access control function entity, where the response message carries a user context corresponding
  • the authentication module 102 may include: a determining unit (not shown) configured to determine whether the terminal is allowed to access by using a user context; and a feedback unit (not shown) configured to be when the determining unit outputs YES , return an access response message to the terminal.
  • a determining unit (not shown) configured to determine whether the terminal is allowed to access by using a user context
  • a feedback unit (not shown) configured to be when the determining unit outputs YES , return an access response message to the terminal.
  • the service access control function entity 1 may further include: a second receiving module 104 configured to receive an update request message from a context database, wherein the update request message is used to update the user context
  • the forwarding module 106 is configured to forward the update request message to a neighbor service access control function entity that has obtained a user context from the service access control function entity.
  • the service access control function entity 1 further includes: a determining module 108, configured to determine whether the terminal is currently in an inactive state and the duration of the inactive state has exceeded a preset threshold; the deleting module 110, The user context is directly deleted when the judgment module output is YES; the update module 112 is configured to update the user context according to the update request message when the judgment module output is no.
  • a determining module 108 configured to determine whether the terminal is currently in an inactive state and the duration of the inactive state has exceeded a preset threshold
  • the deleting module 110 The user context is directly deleted when the judgment module output is YES
  • the update module 112 is configured to update the user context according to the update request message when the judgment module output is no.
  • the service access control function entity 1 may further include: a third receiving module 114 configured to receive a service request message from the terminal; and a first identifying module 116 configured to perform a service request message Identifying, and selecting a service processing function entity for the terminal as the terminal according to the user context and the terminal capability information.
  • a third receiving module 114 configured to receive a service request message from the terminal
  • a first identifying module 116 configured to perform a service request message Identifying, and selecting a service processing function entity for the terminal as the terminal according to the user context and the terminal capability information.
  • the service access control function entity 1 may further include: a fourth receiving module 118, configured to receive a service data packet from the terminal, and insert a user context into the service data packet;
  • the two sending module 120 is configured to send the service data packet to the service processing function entity.
  • the system may further include: a service processing function entity 3; the service processing function entity 3 may include: a first extraction module 300 configured to extract a user context from the service data packet; The module 302 is configured to perform service processing on the service data packet by using the user context and the preset service processing logic.
  • a service processing function entity 3 may include: a first extraction module 300 configured to extract a user context from the service data packet; The module 302 is configured to perform service processing on the service data packet by using the user context and the preset service processing logic.
  • the service access control function entity 1 may further include: a fifth receiving module 122 configured to receive a service request message from the terminal; and a second identification module 124 configured to perform a service request message Identifying, and selecting a service processing function entity for the terminal as the terminal according to the user context and the terminal capability information; and the third sending module 126 is configured to send the user context to the service processing function entity.
  • a fifth receiving module 122 configured to receive a service request message from the terminal
  • a second identification module 124 configured to perform a service request message Identifying, and selecting a service processing function entity for the terminal as the terminal according to the user context and the terminal capability information
  • the third sending module 126 is configured to send the user context to the service processing function entity.
  • the service access control function entity may further include: a sixth receiving module 128, configured to receive the service data packet from the terminal, and insert the associated information of the user context in the service data packet.
  • the fourth sending module 130 is configured to send the service data message to the service processing function entity.
  • the service processing function entity 3 may further include: a second extraction module 304 configured to extract association information from the service data packet; the first obtaining module 306 is configured to acquire context information according to the association information.
  • the second processing module 308 is configured to perform service processing on the service data packet by using the user context and the preset service processing logic.
  • the service access control function entity 1 may further include: a seventh receiving module 132, configured to receive a service data packet from the terminal, and insert an association of the user context in the service data packet.
  • the fifth sending module 134 is configured to send the service data packet to the service processing function entity.
  • the service processing function entity 3 may further include: a third extraction module 310 configured to extract association information from the service data packet; and a second acquisition module 312 configured to use the context information from the context database. Obtaining a user context; the third processing module 314 is configured to perform service processing on the service data packet by using the user context and the preset service processing logic.
  • the service access control function entity 1 may further include: a fourth processing module 136, configured to, after determining that the service processing function entity does not need to perform service processing on the service data packet, The service data packet is forwarded through the service processing function entity.
  • a fourth processing module 136 configured to, after determining that the service processing function entity does not need to perform service processing on the service data packet, The service data packet is forwarded through the service processing function entity.
  • the above embodiments achieve the following technical effects (it is required that the effects are achievable by some preferred embodiments): the technical solution provided by the embodiment of the present invention is solved.
  • the access authentication method provided in the related art is complicated and has a high processing delay.
  • the access authentication method is simple and the access delay is low.
  • modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein.
  • the steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module.
  • the invention is not limited to any specific combination of hardware and software.
  • the communication system, the access authentication method and system based on the communication system provided by the embodiments of the present invention have the following beneficial effects: the access authentication mode is simple, and the access delay is low.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Power Engineering (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本发明公开了一种通信系统、基于通信系统的接入认证方法及系统，在上述系统中，上下文生成功能实体，设置为生成用户上下文，并将生成的用户上下文存储在与上下文生成功能实体匹配的上下文数据库；业务接入控制功能实体，设置为从上下文数据库获取用户上下文，并采用用户上下文对发起接入请求的终端进行认证。根据本发明提供的技术方案，达到了接入认证方式简单、接入时延较低的效果。

Description

通信系统、基于通信系统的接入认证方法及系统 技术领域
本发明涉及通信领域，具体而言，涉及一种通信系统、基于通信系统的接入认证方法及系统。
背景技术
在过去的20多年时间里，移动通信技术得到了飞速发展，为人们生活方式、工作方式以及社会的政治、经济等各方面都带来了巨大的影响。人类社会进入高效的信息化时代，各个方面业务应用需求呈现爆发式增长，给未来无线移动带宽系统在频率、技术以及运营等各方面都带来了巨大的挑战。
第五代移动通信技术(5G)移动宽带系统将成为面向2020年以后人类信息社会需求的无线移动通信系统，其为一个多业务多技术融合的网络，通过技术的演进和创新，满足未来广泛的数据、连接的各种业务不断发展的需要，提升用户体验。
随着无线移动通信系统带宽和能力的提升，面向个人和行业的移动互联网和物联网应用快速发展，移动通信相关产业生态将发生重要变化。无线移动通信技术与计算机及信息技术会更加紧密和更深层次的交叉融合，集成电路、器件工艺、软件技术等也将持续快速发展，支撑未来5G移动宽带产业发展。
根据社会职责和功能、终端用户、业务应用和网络运营等对未来5G的愿景分析，从技术的角度总结5G的关键能力需求如下：
需求一、1000倍的流量增长，单位面积吞吐量显著提升。基于对近年来移动通信网络数据流量增长趋势，业界预测到2020年，全球总移动数据流量将达到2010年总移动数据流量的1000倍。这要求单位面积的吞吐量能力，特别是忙时吞吐量能力同样有1000倍的提升，需要达到100Gbps/km2以上。
需求二、100倍连接器件数目。未来5G网络用户范畴极大扩展，随着物联网的快速发展，业界预计到2020年连接的器件数目将达到500-1000亿。这就要求单位覆盖面积内支持的器件数目将极大增长，在一些场景下单位面积内通过5G移动网络连接的器件数目达到100万/km2，相对4G将增长100倍。
需求三、更小的时延和更高的可靠性。5G网络需要为用户提供随时在线的体验，并满足诸如工业控制、紧急通信等更多高价值场景需求。这一方面要求进一步降低用户面时延和控制面时延，相对4G缩短5-10倍，达到人力反应的极限，例如：5ms(触觉反应)，并提供真正的永远在线体验。另一方面，一些关系人的生命、重大财产安全的业务，要求端到端可靠性提升到99.999％甚至100％。
图1是根据相关技术的第四代移动通信技术(4G)演进分组核心网(EPC)的网络架构示意图。如图1所示，该网络架构可以包括如下部分：
演进的通用移动通信系统陆地无线接入网(E-UTRAN)，设置为实现所有与演进网络有关的无线功能；
移动管理实体(Mobility Management Entity，简称为MME)，负责控制面移动管理，其中，可以包括但不限于：用户上下文和移动状态管理、分配用户临时身份标识；
服务网关实体(Servering Gateway，简称为S-GW)，其为用户面实体，负责用户面数据路由处理；
分组数据网网关(Packet Data Network Gateway，简称为PDN GW或P-GW)，负责用户设备(UE)接入分组数据网(Packet Data Network，简称为PDN)的网关功能；
需要说明的是，P-GW和S-GW可能合设在一个物理实体中。
服务GPRS支持节点(Serving GPRS Supporting Node，简称为SGSN)；
计费和策略控制实体(Policy and Charging Rule Function，简称为PCRF)，设置为策略控制决定和流计费控制功能；
归属网络服务器(Home Subsriber Server，简称为HSS)设置为存储用户签约信息。
然而，面向未来5G网络，上述网络架构主要存在以下缺陷：
在现有的EPC架构中，业务都集中到MME加以控制，业务的接入均需经过MME控制，由此增加了业务接入的处理时延。因此，5G大容量设备接入给集中式的MME管理模式带来了极大地冲击。此外，现有架构模型中的各个网元均采用基于隧道连接技术，因此，不利于分布化动态管理。
发明内容
本发明提供了一种通信系统、基于通信系统的接入认证方法及系统，以至少解决相关技术中提供的接入认证方式较为复杂且处理时延较高的问题。
根据本发明的一个方面，提供了一种通信系统。
根据本发明实施例的包括：上下文生成功能实体，设置为生成用户上下文，并将生成的用户上下文存储在与上下文生成功能实体匹配的上下文数据库；业务接入控制功能实体，设置为从上下文数据库获取用户上下文，并采用用户上下文对发起接入请求的终端进行认证。
优选地，上述系统还包括：业务数据源功能实体，设置为为上下文生成功能实体提供生成用户上下文的数据源。
优选地，上述系统还包括：业务处理功能实体；业务接入控制功能实体，还设置为对终端发起的业务请求进行识别，允许终端发送业务数据，以及将从终端接收到的业务数据转发至业务处理功能实体；业务处理功能实体，设置为对业务数据进行业务处理。
根据本发明的另一方面，提供了一种基于上述通信系统的接入认证方法。
根据本发明实施例的接入认证方法包括：业务接入控制功能实体接收来自于终端的接入请求消息，其中，接入请求消息中携带有终端用户的身份标识信息；业务接入控制功能实体根据身份标识信息获取用户上下文，并采用用户上下文对终端进行接入认证。
优选地，业务接入控制功能实体获取用户上下文包括：业务接入控制功能实体向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；业务接入控制功能实体接收来自于上下文数据库的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
优选地，在业务接入控制功能实体接收来自于上下文数据库的响应消息之后，还包括：上下文数据库确定终端待接入的与业务接入控制功能实体相邻的业务接入控制功能实体；上下文数据库将用户上下文发送至相邻的业务接入控制功能实体。
优选地，业务接入控制功能实体获取用户上下文包括：业务接入控制功能实体向与该业务接入控制功能实体相邻的一个或多个业务接入控制功能实体以及上下文数据 库分别发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；业务接入控制功能实体对最先接收到的响应消息中携带的与身份标识信息对应的用户上下文进行存储，而对其余响应消息中携带的用户上下文进行丢弃。
优选地，业务接入控制功能实体获取用户上下文包括：业务接入控制功能实体向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息，且在上下文数据库发现用户上下文存储在相邻的业务接入控制功能实体的情况下，请求消息由上下文数据库转发至相邻的业务接入控制功能实体；业务接入控制功能实体接收来自于相邻的业务接入控制功能实体的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
优选地，业务接入控制功能实体采用用户上下文对终端进行接入认证包括：业务接入控制功能实体采用用户上下文判断是否允许终端接入；如果是，则业务接入控制功能实体向终端返回接入应答消息。
优选地，在业务接入控制功能实体采用用户上下文对终端进行接入认证之后，还包括：业务接入控制功能实体接收来自于上下文数据库的更新请求消息，其中，更新请求消息用于对用户上下文进行更新；业务接入控制功能实体将更新请求消息转发至已经向该业务接入控制功能实体获取用户上下文的相邻业务接入控制功能实体。
优选地，在业务接入控制功能实体对更新请求消息进行转发之后，还包括：业务接入控制功能实体判断终端当前是否处于非激活状态且处于非激活状态的时长已经超过预设阈值；如果是，则直接将用户上下文进行删除；如果否，则根据更新请求消息对用户上下文进行更新。
优选地，在业务接入控制功能实体采用用户上下文对终端进行接入认证之后，还包括：业务接入控制功能实体接收来自于终端的业务请求消息；业务接入控制功能实体对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体。
优选地，在业务接入控制功能实体为终端选择业务处理功能实体之后，还包括：业务接入控制功能实体接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文；业务接入控制功能实体将业务数据报文发送至业务处理功能实体。
优选地，在业务接入控制功能实体将业务数据报文发送至业务处理功能实体之后，还包括：业务处理功能实体从业务数据报文中提取用户上下文；业务处理功能实体采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，在业务接入控制功能实体采用用户上下文对终端进行接入认证之后，还包括：业务接入控制功能实体接收来自于终端的业务请求消息；业务接入控制功能实体对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体；业务接入控制功能实体将用户上下文发送至业务处理功能实体。
优选地，在业务接入控制功能实体将用户上下文发送至业务处理功能实体之后，还包括：业务接入控制功能实体接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；业务接入控制功能实体将业务数据报文发送至业务处理功能实体。
优选地，在业务接入控制功能实体将业务数据报文发送至业务处理功能实体之后，还包括：业务处理功能实体从业务数据报文中提取关联信息；业务处理功能实体根据关联信息获取上下文信息；业务处理功能实体采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，在业务接入控制功能实体为终端选择业务处理功能实体之后，还包括：业务接入控制功能实体接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；业务接入控制功能实体将业务数据报文发送至业务处理功能实体。
优选地，在业务接入控制功能实体将业务数据报文发送至业务处理功能实体之后，还包括：业务处理功能实体从业务数据报文中提取关联信息；业务处理功能实体根据关联信息从上下文数据库获取用户上下文；业务处理功能实体采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，在业务接入控制功能实体为终端选择业务处理功能实体之后，还包括：业务接入控制功能实体在确定无需由业务处理功能实体对业务数据报文进行业务处理的情况下，不再经由业务处理功能实体对业务数据报文进行转发。
根据本发明的又一方面，提供了一种基于上述通信系统的接入认证系统。
根据本发明实施例的接入认证方法系统包括：业务接入控制功能实体；该业务接入控制功能实体包括：第一接收模块，设置为接收来自于终端的接入请求消息，其中，接入请求消息中携带有终端用户的身份标识信息；认证模块，设置为根据身份标识信息获取用户上下文，并采用用户上下文对终端进行接入认证。
优选地，认证模块包括：第一发送单元，设置为向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；第一接收单元，设置为接收来自于上下文数据库的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
优选地，上述系统还包括：上下文数据库；该上下文数据库包括：确定模块，设置为确定终端待接入的与业务接入控制功能实体相邻的业务接入控制功能实体；第一发送模块，设置为将用户上下文发送至相邻的业务接入控制功能实体。
优选地，认证模块包括：第二发送单元，设置为向与业务接入控制功能实体相邻的一个或多个业务接入控制功能实体以及上下文数据库分别发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；处理单元，设置为对最先接收到的响应消息中携带的与身份标识信息对应的用户上下文进行存储，而对其余响应消息中携带的用户上下文进行丢弃。
优选地，认证模块包括：第三发送单元，设置为向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息，且在上下文数据库发现用户上下文存储在相邻的业务接入控制功能实体的情况下，请求消息由上下文数据库转发至相邻的业务接入控制功能实体；第二接收单元，设置为接收来自于相邻的业务接入控制功能实体的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
优选地，认证模块包括：判断单元，设置为采用用户上下文判断是否允许终端接入；反馈单元，设置为在判断单元输出为是时，向终端返回接入应答消息。
优选地，业务接入控制功能实体还包括：第二接收模块，设置为接收来自于上下文数据库的更新请求消息，其中，更新请求消息用于对用户上下文进行更新；转发模块，设置为将更新请求消息转发至已经向该业务接入控制功能实体获取用户上下文的相邻业务接入控制功能实体。
优选地，业务接入控制功能实体还包括：判断模块，设置为判断终端当前是否处于非激活状态且处于非激活状态的时长已经超过预设阈值；删除模块，设置为在判断模块输出为是时，直接将用户上下文进行删除；更新模块，设置为在判断模块输出为否时，根据更新请求消息对用户上下文进行更新。
优选地，业务接入控制功能实体还包括：第三接收模块，设置为接收来自于终端的业务请求消息；第一识别模块，设置为对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体。
优选地，业务接入控制功能实体还包括：第四接收模块，设置为接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文；第二发送模块，设置为将业务数据报文发送至业务处理功能实体。
优选地，上述系统还包括：业务处理功能实体；业务处理功能实体包括：第一提取模块，设置为从业务数据报文中提取用户上下文；第一处理模块，设置为采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，业务接入控制功能实体还包括：第五接收模块，设置为接收来自于终端的业务请求消息；第二识别模块，设置为对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体；第三发送模块，设置为将用户上下文发送至业务处理功能实体。
优选地，业务接入控制功能实体还包括：第六接收模块，设置为接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；第四发送模块，设置为将业务数据报文发送至业务处理功能实体。
优选地，业务处理功能实体还包括：第二提取模块，设置为从业务数据报文中提取关联信息；第一获取模块，设置为根据关联信息获取上下文信息；第二处理模块，设置为采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，业务接入控制功能实体还包括：第七接收模块，设置为接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；第五发送模块，设置为将业务数据报文发送至业务处理功能实体。
优选地，业务处理功能实体还包括：第三提取模块，设置为从业务数据报文中提取关联信息；第二获取模块，设置为根据关联信息从上下文数据库获取用户上下文；第三处理模块，设置为采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，业务接入控制功能实体还包括：第四处理模块，设置为在确定无需由业务处理功能实体对业务数据报文进行业务处理的情况下，不再经由业务处理功能实体对业务数据报文进行转发。
通过本发明实施例，采用上下文生成功能实体，设置为生成用户上下文，并将生成的用户上下文存储在与上下文生成功能实体匹配的上下文数据库；业务接入控制功能实体，设置为从上下文数据库获取用户上下文，并采用用户上下文对发起接入请求的终端进行认证，解决了相关技术中提供的接入认证方式较为复杂且处理时延较高的问题，进而达到了接入认证方式简单、接入时延较低的效果。
附图说明
此处所说明的附图用来提供对本发明的进一步理解，构成本申请的一部分，本发明的示意性实施例及其说明用于解释本发明，并不构成对本发明的不当限定。在附图中：
图1是根据相关技术的4G EPC的网络架构示意图；
图2是根据本发明实施例的通信系统的结构框图；
图3是根据本发明实施例的通信系统的结构框图；
图4是根据本发明优选实施例的通信系统的示意图；
图5是根据本发明优选实施例的业务数据源功能实体的结构示意图；
图6是根据本发明优选实施例的业务接入控制功能实体的结构框图；
图7是根据本发明实施例的基于通信系统的接入认证方法的流程图；
图8是根据本发明优选实施例一的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图；
图9是根据本发明优选实施例二的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图；
图10是根据本发明优选实施例三的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图；
图11是根据本发明优选实施例四的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图；
图12是根据本发明优选实施例的用户上下文数据或者文件发生变更的方法流程图；
图13是根据本发明优选实施例一的在用户终端发起业务时执行业务处理的流程图；
图14是根据本发明优选实施例二的在用户终端发起业务时执行业务处理的流程图；
图15是根据本发明优选实施例三的在用户终端发起业务时执行业务处理的流程图；
图16是根据本发明优选实施例四的在用户终端发起业务时执行业务处理的流程图；
图17是根据本发明实施例的基于通信系统的接入认证系统的结构框图；
图18是根据本发明优选实施例的基于通信系统的接入认证系统的结构框图。
具体实施方式
下文中将参考附图并结合实施例来详细说明本发明。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的特征可以相互组合。
图2是根据本发明实施例的通信系统的结构框图。如图2所示，该通信系统可以包括：上下文生成功能实体10，设置为生成用户上下文，并将生成的用户上下文存储在与上下文生成功能实体匹配的上下文数据库；业务接入控制功能实体20，设置为从上下文数据库获取用户上下文，并采用用户上下文对发起接入请求的终端进行认证。
相关技术中提供的接入认证方式较为复杂且处理时延较高。采用如图2所示的系统，不再采用现有的EPC架构中的MME进行业务接入控制，而是转用上下文生成功能实体与业务接入控制功能实体相结合的方式进行业务接入认证。由此解决了相关技术中提供的接入认证方式较为复杂且处理时延较高的问题，进而达到了接入认证方式简单、接入时延较低的效果。
优选地，如图3所示，上述系统还可以包括：业务数据源功能实体30，设置为为上下文生成功能实体提供生成用户上下文的数据源。
优选地，如图3所示，上述系统还可以包括：业务处理功能实体40；业务接入控制功能实体，还设置为对终端发起的业务请求进行识别，允许终端发送业务数据，以 及将从终端接收到的业务数据转发至业务处理功能实体；业务处理功能实体，设置为对业务数据进行业务处理。
作为本发明的一个优选实施例，图4是根据本发明优选实施例的通信系统的示意图。如图4所示，该通信系统可以包括：业务数据源功能实体，上下文生成功能实体及上下文数据库，业务接入控制功能实体，业务处理功能实体。各个功能实体所能够实现的具体功能如下：
(1)业务数据源功能实体主要负责为上下文生成功能实体提供数据源。图5是根据本发明优选实施例的业务数据源功能实体的结构示意图。如图5所示，业务数据源功能实体可以包括但不限于：电信网元用户归属服务器，鉴权/授权与计帐服务器(Authentication，Accounting，Authorization Server，简称为AAA)，业务编排服务器(Service Orchestrator)，计费中心(Account Center)，大数据分析(Big-Data Analysis)以及第三方管理平台(Third-Party Mgmt)。
(2)上下文生成功能实体及上下文数据库，主要负责收集、汇总与用户相关的业务数据源数据，并转换生成基于用户并被业务理解的上下文数据格式或者文件。当用户终端接入网络时，负责将用户上下文数据或者文件推送到用户接入或者邻近的业务接入控制功能实体，其中：上述用户上下文可以包括但不限于如下信息：
1)用户的业务签约信息(例如：用户已经签约完成了哪些业务)；
2)用户的服务质量QoS信息(例如：用户签约的保证带宽，最大和最小带宽信息)；
3)用户等级信息(例如：用户优先级信息)；
4)用户的计费信息；
5)用户的行为习惯信息；
6)用户的安全授权，认证信息；
7)用户业务路由策略信息；
8)第三方管理信息。
(3)业务接入控制功能实体，图6是根据本发明优选实施例的业务接入控制功能实体的结构框图。如图6所示，业务接入控制功能实体可以包括：接入控制管理模块， 设置为根据用户上下文对用户终端接入和业务请求进行管控、认证以及授权；业务识别模块，设置为对用户发起的业务进行识别；业务分流模块，设置为根据用户上下文信息及用户终端能力信息为该用户终端选择服务的业务处理功能实体；媒体处理模块，设置为对用户终端发起的转发面数据报文格式进行转换，例如：插入用户上下文相关信息等操作。
(4)业务处理功能实体，负责根据业务接入控制功能实体告知的用户上下文信息以及预设的业务处理逻辑，对接收到的数据报文进行业务处理。
图7是根据本发明实施例的基于通信系统的接入认证方法的流程图。如图7所示，该方法可以包括以下处理步骤：
步骤S702：业务接入控制功能实体接收来自于终端的接入请求消息，其中，接入请求消息中携带有终端用户的身份标识信息；
步骤S704：业务接入控制功能实体根据身份标识信息获取用户上下文，并采用用户上下文对终端进行接入认证。
优选地，在步骤S704中，业务接入控制功能实体获取用户上下文可以包括以下操作：
步骤S1：业务接入控制功能实体向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；
步骤S2：业务接入控制功能实体接收来自于上下文数据库的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
图8是根据本发明优选实施例一的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图。如图8所示，该流程可以包括以下处理步骤：
步骤S802：终端向业务接入控制功能实体发送接入请求消息，其中，该接入请求消息中携带有用户身份标识信息；
步骤S804：业务接入控制功能实体检查是否存在有效的用户的上下文数据或文件，上下文有效性可以根据上下文中所携带的有效性状态，例如：上下文有效生命周期或者其他状态信息来进行判断。如果存在，则直接转到步骤S810；
步骤S806：如果发现不存在有效的上下文，则业务接入控制功能实体向上下文数据库发送获取用户上下文的请求消息，其中，该请求消息中携带有用户身份标识信息；
步骤S808：上下文数据库记录获取上下文的业务接入控制功能实体的地址信息，通过插入用户上下文消息，向业务接入控制功能实体返回用户上下文；
步骤S810：业务接入控制功能实体可以根据用户的上行文信息对用户终端的接入进行认证，如果允许该用户终端接入，则向终端返回接入应答。
优选地，在步骤S2，业务接入控制功能实体接收来自于上下文数据库的响应消息之后，还可以包括以下步骤：
步骤S3：上下文数据库确定终端待接入的与业务接入控制功能实体相邻的业务接入控制功能实体；
步骤S4：上下文数据库将用户上下文发送至相邻的业务接入控制功能实体。
图9是根据本发明优选实施例二的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图。如图9所示，该流程可以包括以下处理步骤：
步骤S902：终端向业务接入控制功能实体发送接入请求消息，其中，该接入请求消息中携带有用户身份标识信息；
步骤S904：业务接入控制功能实体检查是否存在有效的用户的上下文数据或文件，上下文有效性可以根据上下文中所携带的有效性状态，例如：上下文有效生命周期或者其他状态信息来进行判断。如果存在，则直接转到步骤S910；
步骤S906：如果发现不存在有效的上下文，则业务接入控制功能实体向上下文数据库发送获取用户上下文的请求消息，其中，该请求消息中携带有用户身份标识信息；
步骤S908：上下文数据库记录获取上下文的业务接入控制功能实体的地址信息，通过插入用户上下文消息，向业务接入控制功能实体返回用户上下文；
步骤S910：业务接入控制功能实体可以根据用户的上行文信息对用户终端的接入进行认证，如果允许该用户终端接入，则向终端返回接入应答；
步骤S912：上下文数据库感知用户行为特性，如果发现用户属于高移动性终端，或者其他因素，上下文数据库决定将用户的上下文数据或者文件主动推送到用户接入的相邻业务接入控制功能实体，以便于当用户移动到相邻业务接入控制功能实体时，则该业务接入控制功能实体无需再向上下文数据库获取上下文；
步骤S914：上下文数据库通知并推送用户上下文数据或文件至相邻业务接入控制功能实体，由该业务接入控制功能实体对上下文进行保存。
优选地，在步骤S704中，业务接入控制功能实体获取用户上下文可以包括以下操作：
步骤S5：业务接入控制功能实体向与该业务接入控制功能实体相邻的一个或多个业务接入控制功能实体以及上下文数据库分别发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；
步骤S6：业务接入控制功能实体对最先接收到的响应消息中携带的与身份标识信息对应的用户上下文进行存储，而对其余响应消息中携带的用户上下文进行丢弃。
图10是根据本发明优选实施例三的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图。如图10所示，该流程可以包括以下处理步骤：
步骤S1002：终端向业务接入控制功能实体1发送接入请求消息，其中，该接入请求消息中携带有用户身份标识信息；
步骤S1004：业务接入控制功能实体1检查是否存在有效的用户的上下文数据或文件，如果存在，则直接转到步骤S1016；
步骤S1006a-步骤S1006c：为了提高业务接入控制功能实体1获取用户上下文的速度，该业务接入控制功能实体1同时向邻接业务接入控制功能实体2和邻接业务接入控制功能实体3发送获取上下文请求，并同时向上下文数据库发送获取上下文请求；
步骤S1008：邻接业务接入控制功能实体2在接收到请求消息之后，判断存在该用户的有效上下文，则向业务接入控制功能实体1返回用户上下文数据或文件；业务接入控制功能实体1保存最先接收到的上下文信息；
步骤S1010：邻接业务接入控制功能实体3在接收到请求消息之后，判断不存在该用户的有效上下文，则丢弃上述请求消息；
步骤S1012：上下文数据库在接收到请求消息之后，也会向业务接入控制功能实体1返回用户上下文；
步骤S1014：业务接入控制功能实体1在接收到上下文数据库返回的上下文信息之后，确定已经获取到该上下文信息，则将该上下文信息进行丢弃；
步骤S1016：业务接入控制功能实体1可以根据用户的上行文信息对用户终端的接入进行认证，如果允许该用户终端接入，则向终端返回接入应答。
优选地，在步骤S704中，业务接入控制功能实体获取用户上下文可以包括以下步骤：
步骤S7：业务接入控制功能实体向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息，且在上下文数据库发现用户上下文存储在相邻的业务接入控制功能实体的情况下，请求消息由上下文数据库转发至相邻的业务接入控制功能实体；
步骤S8：业务接入控制功能实体接收来自于相邻的业务接入控制功能实体的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
图11是根据本发明优选实施例四的在用户终端接入网络时，业务接入控制功能实体获取用户上下文方法的流程图。如图11所示，该流程可以包括以下处理步骤：
步骤S1102：终端向业务接入控制功能实体发送接入请求消息，其中，该接入请求消息中携带有用户身份标识信息；
步骤S1104：业务接入控制功能实体检查是否存在有效的用户的上下文数据或文件，如果存在，则直接转到步骤S1114；
步骤S1106：如果发现不存在有效的上下文，则业务接入控制功能实体向上下文数据库发送获取用户上下文的请求消息，其中，该请求消息中携带有用户身份标识信息；
步骤S1108：上下文数据库发现业务接入控制功能实体请求的用户上下文存在于其邻接的业务接入控制功能实体；
步骤S1110：上下文数据库将请求消息转向(或者重定向)至邻接业务接入控制功能实体；
步骤S1112：邻接业务接入控制功能实体在接收到上述请求消息之后，确定存在该用户的有效上下文，则向业务接入控制功能实体返回用户上下文数据或文件，然后由业务接入控制功能实体存储接收到的用户上下文信息；
步骤S1114：业务接入控制功能实体可以根据用户的上行文信息对用户终端的接入进行认证，如果允许该用户终端接入，则向终端返回接入应答。
在优选实施过程中，在步骤S704中，业务接入控制功能实体采用用户上下文对终端进行接入认证可以包括以下操作：
步骤S9：业务接入控制功能实体采用用户上下文判断是否允许终端接入；
步骤S10：如果是，则业务接入控制功能实体向终端返回接入应答消息。
优选地，在步骤S704，业务接入控制功能实体采用用户上下文对终端进行接入认证之后，还可以包括以下操作：
步骤S11：业务接入控制功能实体接收来自于上下文数据库的更新请求消息，其中，更新请求消息用于对用户上下文进行更新；
步骤S12：业务接入控制功能实体将更新请求消息转发至已经向该业务接入控制功能实体获取用户上下文的相邻业务接入控制功能实体。
优选地，在步骤S12，业务接入控制功能实体对更新请求消息进行转发之后，还可以包括以下步骤：
步骤S13：业务接入控制功能实体判断终端当前是否处于非激活状态且处于非激活状态的时长已经超过预设阈值；
步骤S14：如果是，则直接将用户上下文进行删除；
步骤S15：如果否，则根据更新请求消息对用户上下文进行更新。
图12是根据本发明优选实施例的用户上下文数据或者文件发生变更的方法流程图。如图12所示，该方法可以包括以下处理步骤：
步骤S1202：上下文数据库感知用户上下文发生变更或者已经失效；
步骤S1204：上下文数据库根据记录获取用户上下文的业务接入控制功能实体的地址信息，然后向该业务接入控制功能实体发送更新上下文请求消息，其中，该更新上下文请求消息中可以携带最新的用户上下文；
步骤S1206：业务接入控制功能实体发现邻接业务接入控制功能实体也曾经向其获取过用户上下文；
步骤S1208：业务接入控制功能实体向邻接业务接入控制功能实体发送更新上下文请求消息；
步骤S1210：业务接入控制功能实体通过检查发现与用户上下文对应的用户终端处于非激活状态，而如果用户终端在该业务接入控制功能实体的非活动时间已经超过预设阈值，则删除其保存的用户上下文；否则继续执行步骤S1212；
步骤S1212：业务接入控制功能实体对上下文数据库的用户上下文进行更新。
需要说明的是，上述步骤S1212为可选步骤，如果在步骤S1204中已经包含用户上下文或者上下文数据库指示上下文失效，则不再需要执行步骤S1212。
优选地，在步骤S704，业务接入控制功能实体采用用户上下文对终端进行接入认证之后，还可以包括以下步骤：
步骤S16：业务接入控制功能实体接收来自于终端的业务请求消息；
步骤S17：业务接入控制功能实体对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体。
优选地，在步骤S17，业务接入控制功能实体为终端选择业务处理功能实体之后，还可以包括以下操作：
步骤S18：业务接入控制功能实体接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文；
步骤S19：业务接入控制功能实体将业务数据报文发送至业务处理功能实体。
优选地，在步骤S19，业务接入控制功能实体将业务数据报文发送至业务处理功能实体之后，还可以包括以下步骤：
步骤S20：业务处理功能实体从业务数据报文中提取用户上下文；
步骤S21：业务处理功能实体采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
图13是根据本发明优选实施例一的在用户终端发起业务时执行业务处理的流程图。如图13所示，该流程可以包括以下处理步骤：
步骤S1302：终端发起业务请求消息，其中，该业务请求消息中携带有用户的身份标识，所发起的业务类型等信息；
步骤S1304：业务接入控制功能实体对用户终端发起的业务进行认证授权；
步骤S1306：业务接入控制功能实体对用户发起的业务进行识别，根据用户上下文中的签约信息以及终端能力信息选择为用户当前业务进行服务的业务处理功能实体；
步骤S1308：业务接入控制功能实体对用户的业务请求认证通过，则向用户终端返回业务请求应答消息；
步骤S1310：用户终端向网络发送业务数据报文；
步骤S1312：业务接入控制功能实体在接收到的业务数据报文中插入与用户对应的上下文信息；
步骤S1314：业务接入控制功能实体将业务数据报文转发至上述选择的业务处理功能实体；
步骤S1316：业务处理功能实体获取业务数据报文中插入的用户上下文信息，并根据预设的业务处理逻辑对接收到的业务数据报文进行业务处理；
步骤S1318：业务处理功能实体将处理后的业务数据报文转发至下一跳。
优选地，在步骤S704，业务接入控制功能实体采用用户上下文对终端进行接入认证之后，还可以包括以下操作：
步骤S22：业务接入控制功能实体接收来自于终端的业务请求消息；
步骤S23：业务接入控制功能实体对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体；
步骤S24：业务接入控制功能实体将用户上下文发送至业务处理功能实体。
优选地，在步骤S24，业务接入控制功能实体将用户上下文发送至业务处理功能实体之后，还可以包括以下操作：
步骤S25：业务接入控制功能实体接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；
步骤S26：业务接入控制功能实体将业务数据报文发送至业务处理功能实体。
优选地，在步骤S26，业务接入控制功能实体将业务数据报文发送至业务处理功能实体之后，还可以包括以下步骤：
步骤S27：业务处理功能实体从业务数据报文中提取关联信息；
步骤S28：业务处理功能实体根据关联信息获取上下文信息；
步骤S29：业务处理功能实体采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
图14是根据本发明优选实施例二的在用户终端发起业务时执行业务处理的流程图。如图14所示，该流程可以包括以下处理步骤：
步骤S1402：终端发起业务请求消息，其中，该业务请求消息中携带有用户的身份标识，所发起的业务类型等信息；
步骤S1404：业务接入控制功能实体对用户终端发起的业务进行认证授权；
步骤S1406：业务接入控制功能实体对用户发起的业务进行识别，根据用户上下文中的签约信息以及终端能力信息选择为用户当前业务进行服务的业务处理功能实体；
步骤S1408：业务接入控制功能实体对用户的业务请求认证通过，则向用户终端返回业务请求应答消息；
步骤S1410：业务接入控制功能实体将用户上下文信息传递给其选择的业务处理功能实体；
步骤S1412：用户终端向网络发送业务数据报文；
步骤S1414：业务接入控制功能实体在接收到的业务数据报文中插入用户对应的上下文关联信息，例如：上下文标识信息；
步骤S1416：业务接入控制功能实体将业务数据报文转发至上述选择的业务处理功能实体；
步骤S1418：业务处理功能实体获取业务数据报文中的用户上下文关联信息，并根据用户上下文关联信息关联至已经获得到的用户上下文信息，然后再根据预设的业务处理逻辑对接收到的业务数据报文进行业务处理；
步骤S1420：业务处理功能实体将处理后的业务数据报文转发至下一跳。
优选地，在步骤S17，业务接入控制功能实体为终端选择业务处理功能实体之后，还可以包括以下步骤：
步骤S30：业务接入控制功能实体接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；
步骤S31：业务接入控制功能实体将业务数据报文发送至业务处理功能实体。
优选地，在步骤S31，业务接入控制功能实体将业务数据报文发送至业务处理功能实体之后，还可以包括以下操作：
步骤S32：业务处理功能实体从业务数据报文中提取关联信息；
步骤S33：业务处理功能实体根据关联信息从上下文数据库获取用户上下文；
步骤S34：业务处理功能实体采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
图15是根据本发明优选实施例三的在用户终端发起业务时执行业务处理的流程图。如图15所示，该流程可以包括以下处理步骤：
步骤S1502：终端发起业务请求消息，其中，该业务请求消息中携带有用户的身份标识，所发起的业务类型等信息；
步骤S1504：业务接入控制功能实体对用户终端发起的业务进行认证授权；
步骤S1506：业务接入控制功能实体对用户发起的业务进行识别，根据用户上下文中的签约信息以及终端能力信息选择为用户当前业务进行服务的业务处理功能实体；
步骤S1508：业务接入控制功能实体对用户的业务请求认证通过，则向用户终端返回业务请求应答消息；
步骤S1510：用户终端向网络发送业务数据报文；
步骤S1512：业务接入控制功能实体在接收到的业务数据报文中插入用户对应的上下文关联信息，例如：上下文标识信息；
步骤S1514：业务接入控制功能实体将业务数据报文转发至上述选择的业务处理功能实体；
步骤S1516：业务处理功能实体根据业务数据报文中携带的上下文关联信息，向上下文数据库获取用户上下文信息；
步骤S1518：业务处理功能实体根据预设的业务处理逻辑对接收到的业务数据报文进行业务处理；
步骤S1520：业务处理功能实体将处理后的业务数据报文转发至下一跳。
优选地，在步骤S17，业务接入控制功能实体为终端选择业务处理功能实体之后，还可以包括以下步骤：
步骤S35：业务接入控制功能实体在确定无需由业务处理功能实体对业务数据报文进行业务处理的情况下，不再经由业务处理功能实体对业务数据报文进行转发。
图16是根据本发明优选实施例四的在用户终端发起业务时执行业务处理的流程图。如图16所示，该流程可以包括以下处理步骤：
步骤S1602：终端发起业务请求消息，其中，该业务请求消息中携带有用户的身份标识，所发起的业务类型等信息；
步骤S1604：业务接入控制功能实体对用户终端发起的业务进行认证授权；
步骤S1606：业务接入控制功能实体对用户发起的业务进行识别，根据用户上下文中的签约信息以及终端能力信息选择为用户当前业务进行服务的业务处理功能实体；
在该优选实施例中，业务接入控制功能实体发现用户当前发起的业务无需由业务处理功能实体进行处理；
步骤S1608：业务接入控制功能实体对用户的业务请求认证通过，则向用户终端返回业务请求应答消息；
步骤S1610：用户终端向网络发送业务数据报文；
步骤S1612：业务接入控制功能实体认为不需要业务处理功能实体来处理其所接收到的业务数据报文，则将该业务数据报文转发至互联网或者目的服务器。
图17是根据本发明实施例的基于通信系统的接入认证系统的结构框图。如图17所示，该接入认证系统可以包括：业务接入控制功能实体1；该业务接入控制功能实 体1可以包括：第一接收模块100，设置为接收来自于终端的接入请求消息，其中，接入请求消息中携带有终端用户的身份标识信息；认证模块102，设置为根据身份标识信息获取用户上下文，并采用用户上下文对终端进行接入认证。
优选地，认证模块102可以包括：第一发送单元(图中未示出)，设置为向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；第一接收单元(图中未示出)，设置为接收来自于上下文数据库的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
优选地，如图18所示，上述系统还可以包括：上下文数据库2；该上下文数据库2可以包括：确定模块200，设置为确定终端待接入的与业务接入控制功能实体相邻的业务接入控制功能实体；第一发送模块202，设置为将用户上下文发送至相邻的业务接入控制功能实体。
优选地，认证模块102可以包括：第二发送单元(图中未示出)，设置为向与业务接入控制功能实体相邻的一个或多个业务接入控制功能实体以及上下文数据库分别发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息；处理单元(图中未示出)，设置为对最先接收到的响应消息中携带的与身份标识信息对应的用户上下文进行存储，而对其余响应消息中携带的用户上下文进行丢弃。
优选地，认证模块102可以包括：第三发送单元(图中未示出)，设置为向上下文数据库发送获取用户上下文的请求消息，其中，请求消息中携带有身份标识信息，且在上下文数据库发现用户上下文存储在相邻的业务接入控制功能实体的情况下，请求消息由上下文数据库转发至相邻的业务接入控制功能实体；第二接收单元(图中未示出)，设置为接收来自于相邻的业务接入控制功能实体的响应消息，其中，响应消息中携带有与身份标识信息对应的用户上下文。
优选地，认证模块102可以包括：判断单元(图中未示出)，设置为采用用户上下文判断是否允许终端接入；反馈单元(图中未示出)，设置为在判断单元输出为是时，向终端返回接入应答消息。
优选地，如图18所示，业务接入控制功能实体1还可以包括：第二接收模块104，设置为接收来自于上下文数据库的更新请求消息，其中，更新请求消息用于对用户上下文进行更新；转发模块106，设置为将更新请求消息转发至已经向该业务接入控制功能实体获取用户上下文的相邻业务接入控制功能实体。
优选地，如图18所示，业务接入控制功能实体1还包括：判断模块108，设置为判断终端当前是否处于非激活状态且处于非激活状态的时长已经超过预设阈值；删除模块110，设置为在判断模块输出为是时，直接将用户上下文进行删除；更新模块112，设置为在判断模块输出为否时，根据更新请求消息对用户上下文进行更新。
优选地，如图18所示，业务接入控制功能实体1还可以包括：第三接收模块114，设置为接收来自于终端的业务请求消息；第一识别模块116，设置为对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体。
优选地，如图18所示，业务接入控制功能实体1还可以包括：第四接收模块118，设置为接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文；第二发送模块120，设置为将业务数据报文发送至业务处理功能实体。
优选地，如图18所示，上述系统还可以包括：业务处理功能实体3；业务处理功能实体3可以包括：第一提取模块300，设置为从业务数据报文中提取用户上下文；第一处理模块302，设置为采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，如图18所示，业务接入控制功能实体1还可以包括：第五接收模块122，设置为接收来自于终端的业务请求消息；第二识别模块124，设置为对业务请求消息进行识别，并根据用户上下文和终端能力信息为终端选择为终端服务的业务处理功能实体；第三发送模块126，设置为将用户上下文发送至业务处理功能实体。
优选地，如图18所示，业务接入控制功能实体还可以包括：第六接收模块128，设置为接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；第四发送模块130，设置为将业务数据报文发送至业务处理功能实体。
优选地，如图18所示，业务处理功能实体3还可以包括：第二提取模块304，设置为从业务数据报文中提取关联信息；第一获取模块306，设置为根据关联信息获取上下文信息；第二处理模块308，设置为采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，如图18所示，业务接入控制功能实体1还可以包括：第七接收模块132，设置为接收来自于终端的业务数据报文，并在业务数据报文中插入用户上下文的关联信息；第五发送模块134，设置为将业务数据报文发送至业务处理功能实体。
优选地，如图18所示，业务处理功能实体3还可以包括：第三提取模块310，设置为从业务数据报文中提取关联信息；第二获取模块312，设置为根据关联信息从上下文数据库获取用户上下文；第三处理模块314，设置为采用用户上下文和预设的业务处理逻辑对业务数据报文进行业务处理。
优选地，如图18所示，业务接入控制功能实体1还可以包括：第四处理模块136，设置为在确定无需由业务处理功能实体对业务数据报文进行业务处理的情况下，不再经由业务处理功能实体对业务数据报文进行转发。
从以上的描述中，可以看出，上述实施例实现了如下技术效果(需要说明的是这些效果是某些优选实施例可以达到的效果)：采用本发明实施例所提供的技术方案，解决了相关技术中提供的接入认证方式较为复杂且处理时延较高的问题，进而达到了接入认证方式简单、接入时延较低的效果。
显然，本领域的技术人员应该明白，上述的本发明的各模块或各步骤可以用通用的计算装置来实现，它们可以集中在单个的计算装置上，或者分布在多个计算装置所组成的网络上，可选地，它们可以用计算装置可执行的程序代码来实现，从而，可以将它们存储在存储装置中由计算装置来执行，并且在某些情况下，可以以不同于此处的顺序执行所示出或描述的步骤，或者将它们分别制作成各个集成电路模块，或者将它们中的多个模块或步骤制作成单个集成电路模块来实现。这样，本发明不限制于任何特定的硬件和软件结合。
以上所述仅为本发明的优选实施例而已，并不用于限制本发明，对于本领域的技术人员来说，本发明可以有各种更改和变化。凡在本发明的精神和原则之内，所作的任何修改、等同替换、改进等，均应包含在本发明的保护范围之内。
工业实用性
如上所述，本发明实施例提供的一种通信系统、基于通信系统的接入认证方法及系统具有以下有益效果：接入认证方式简单、接入时延较低。

Claims (37)

  1. 一种通信系统，包括：
    上下文生成功能实体，设置为生成用户上下文，并将生成的所述用户上下文存储在与所述上下文生成功能实体匹配的上下文数据库；
    业务接入控制功能实体，设置为从所述上下文数据库获取所述用户上下文，并采用所述用户上下文对发起接入请求的终端进行认证。
  2. 根据权利要求1所述的系统，其中，所述系统还包括：
    业务数据源功能实体，设置为为所述上下文生成功能实体提供生成所述用户上下文的数据源。
  3. 根据权利要求1所述的系统，其中，所述系统还包括：业务处理功能实体；
    所述业务接入控制功能实体，还设置为对所述终端发起的业务请求进行识别，允许所述终端发送业务数据，以及将从所述终端接收到的所述业务数据转发至所述业务处理功能实体；
    所述业务处理功能实体，设置为对所述业务数据进行业务处理。
  4. 一种基于权利要求1至3中任一项所述的通信系统的接入认证方法，包括：
    业务接入控制功能实体接收来自于终端的接入请求消息，其中，所述接入请求消息中携带有终端用户的身份标识信息；
    所述业务接入控制功能实体根据所述身份标识信息获取用户上下文，并采用所述用户上下文对所述终端进行接入认证。
  5. 根据权利要求4所述的方法，其中，所述业务接入控制功能实体获取所述用户上下文包括：
    所述业务接入控制功能实体向上下文数据库发送获取所述用户上下文的请求消息，其中，所述请求消息中携带有所述身份标识信息；
    所述业务接入控制功能实体接收来自于所述上下文数据库的响应消息，其中，所述响应消息中携带有与所述身份标识信息对应的所述用户上下文。
  6. 根据权利要求5所述的方法，其中，在所述业务接入控制功能实体接收来自于所述上下文数据库的所述响应消息之后，还包括：
    所述上下文数据库确定所述终端待接入的与所述业务接入控制功能实体相邻的业务接入控制功能实体；
    所述上下文数据库将所述用户上下文发送至所述相邻的业务接入控制功能实体。
  7. 根据权利要求4所述的方法，其中，所述业务接入控制功能实体获取所述用户上下文包括：
    所述业务接入控制功能实体向与该业务接入控制功能实体相邻的一个或多个业务接入控制功能实体以及上下文数据库分别发送获取所述用户上下文的请求消息，其中，所述请求消息中携带有所述身份标识信息；
    所述业务接入控制功能实体对最先接收到的响应消息中携带的与所述身份标识信息对应的所述用户上下文进行存储，而对其余响应消息中携带的所述用户上下文进行丢弃。
  8. 根据权利要求4所述的方法，其中，所述业务接入控制功能实体获取所述用户上下文包括：
    所述业务接入控制功能实体向上下文数据库发送获取所述用户上下文的请求消息，其中，所述请求消息中携带有所述身份标识信息，且在所述上下文数据库发现所述用户上下文存储在相邻的业务接入控制功能实体的情况下，所述请求消息由所述上下文数据库转发至所述相邻的业务接入控制功能实体；
    所述业务接入控制功能实体接收来自于所述相邻的业务接入控制功能实体的响应消息，其中，所述响应消息中携带有与所述身份标识信息对应的所述用户上下文。
  9. 根据权利要求4至8中任一项所述的方法，其中，所述业务接入控制功能实体采用所述用户上下文对所述终端进行接入认证包括：
    所述业务接入控制功能实体采用所述用户上下文判断是否允许所述终端接入；
    如果是，则所述业务接入控制功能实体向所述终端返回接入应答消息。
  10. 根据权利要求4所述的方法，其中，在所述业务接入控制功能实体采用所述用户上下文对所述终端进行接入认证之后，还包括：
    所述业务接入控制功能实体接收来自于上下文数据库的更新请求消息，其中，所述更新请求消息用于对所述用户上下文进行更新；
    所述业务接入控制功能实体将所述更新请求消息转发至已经向该业务接入控制功能实体获取所述用户上下文的相邻业务接入控制功能实体。
  11. 根据权利要求10所述的方法，其中，在所述业务接入控制功能实体对所述更新请求消息进行转发之后，还包括：
    所述业务接入控制功能实体判断所述终端当前是否处于非激活状态且处于所述非激活状态的时长已经超过预设阈值；
    如果是，则直接将所述用户上下文进行删除；
    如果否，则根据所述更新请求消息对所述用户上下文进行更新。
  12. 根据权利要求4所述的方法，其中，在所述业务接入控制功能实体采用所述用户上下文对所述终端进行接入认证之后，还包括：
    所述业务接入控制功能实体接收来自于所述终端的业务请求消息；
    所述业务接入控制功能实体对所述业务请求消息进行识别，并根据所述用户上下文和终端能力信息为所述终端选择为所述终端服务的业务处理功能实体。
  13. 根据权利要求12所述的方法，其中，在所述业务接入控制功能实体为所述终端选择所述业务处理功能实体之后，还包括：
    所述业务接入控制功能实体接收来自于所述终端的业务数据报文，并在所述业务数据报文中插入所述用户上下文；
    所述业务接入控制功能实体将所述业务数据报文发送至所述业务处理功能实体。
  14. 根据权利要求13所述的方法，其中，在所述业务接入控制功能实体将所述业务数据报文发送至所述业务处理功能实体之后，还包括：
    所述业务处理功能实体从所述业务数据报文中提取所述用户上下文；
    所述业务处理功能实体采用所述用户上下文和预设的业务处理逻辑对所述业务数据报文进行业务处理。
  15. 根据权利要求4所述的方法，其中，在所述业务接入控制功能实体采用所述用户上下文对所述终端进行接入认证之后，还包括：
    所述业务接入控制功能实体接收来自于所述终端的业务请求消息；
    所述业务接入控制功能实体对所述业务请求消息进行识别，并根据所述用户上下文和终端能力信息为所述终端选择为所述终端服务的业务处理功能实体；
    所述业务接入控制功能实体将所述用户上下文发送至所述业务处理功能实体。
  16. 根据权利要求15所述的方法，其中，在所述业务接入控制功能实体将所述用户上下文发送至所述业务处理功能实体之后，还包括：
    所述业务接入控制功能实体接收来自于所述终端的业务数据报文，并在所述业务数据报文中插入所述用户上下文的关联信息；
    所述业务接入控制功能实体将所述业务数据报文发送至所述业务处理功能实体。
  17. 根据权利要求16所述的方法，其中，在所述业务接入控制功能实体将所述业务数据报文发送至所述业务处理功能实体之后，还包括：
    所述业务处理功能实体从所述业务数据报文中提取所述关联信息；
    所述业务处理功能实体根据所述关联信息获取所述上下文信息；
    所述业务处理功能实体采用所述用户上下文和预设的业务处理逻辑对所述业务数据报文进行业务处理。
  18. 根据权利要求12所述的方法，其中，在所述业务接入控制功能实体为所述终端选择所述业务处理功能实体之后，还包括：
    所述业务接入控制功能实体接收来自于所述终端的业务数据报文，并在所述业务数据报文中插入所述用户上下文的关联信息；
    所述业务接入控制功能实体将所述业务数据报文发送至所述业务处理功能实体。
  19. 根据权利要求18所述的方法，其中，在所述业务接入控制功能实体将所述业务数据报文发送至所述业务处理功能实体之后，还包括：
    所述业务处理功能实体从所述业务数据报文中提取所述关联信息；
    所述业务处理功能实体根据所述关联信息从所述上下文数据库获取所述用户上下文；
    所述业务处理功能实体采用所述用户上下文和预设的业务处理逻辑对所述业务数据报文进行业务处理。
  20. 根据权利要求12所述的方法，其中，在所述业务接入控制功能实体为所述终端选择所述业务处理功能实体之后，还包括：
    所述业务接入控制功能实体在确定无需由所述业务处理功能实体对所述业务数据报文进行业务处理的情况下，不再经由所述业务处理功能实体对所述业务数据报文进行转发。
  21. 一种接入认证系统，包括：业务接入控制功能实体；
    所述业务接入控制功能实体包括：
    第一接收模块，设置为接收来自于终端的接入请求消息，其中，所述接入请求消息中携带有终端用户的身份标识信息；
    认证模块，设置为根据所述身份标识信息获取用户上下文，并采用所述用户上下文对所述终端进行接入认证。
  22. 根据权利要求21所述的系统，其中，所述认证模块包括：
    第一发送单元，设置为向上下文数据库发送获取所述用户上下文的请求消息，其中，所述请求消息中携带有所述身份标识信息；
    第一接收单元，设置为接收来自于所述上下文数据库的响应消息，其中，所述响应消息中携带有与所述身份标识信息对应的所述用户上下文。
  23. 根据权利要求22所述的系统，其中，所述系统还包括：所述上下文数据库；
    所述上下文数据库包括：
    确定模块，设置为确定所述终端待接入的与所述业务接入控制功能实体相邻的业务接入控制功能实体；
    第一发送模块，设置为将所述用户上下文发送至所述相邻的业务接入控制功能实体。
  24. 根据权利要求21所述的系统，其中，所述认证模块包括：
    第二发送单元，设置为向与所述业务接入控制功能实体相邻的一个或多个业务接入控制功能实体以及上下文数据库分别发送获取所述用户上下文的请求消息，其中，所述请求消息中携带有所述身份标识信息；
    处理单元，设置为对最先接收到的响应消息中携带的与所述身份标识信息对应的所述用户上下文进行存储，而对其余响应消息中携带的所述用户上下文进行丢弃。
  25. 根据权利要求21所述的系统，其中，所述认证模块包括：
    第三发送单元，设置为向上下文数据库发送获取所述用户上下文的请求消息，其中，所述请求消息中携带有所述身份标识信息，且在所述上下文数据库发现所述用户上下文存储在相邻的业务接入控制功能实体的情况下，所述请求消息由所述上下文数据库转发至所述相邻的业务接入控制功能实体；
    第二接收单元，设置为接收来自于所述相邻的业务接入控制功能实体的响应消息，其中，所述响应消息中携带有与所述身份标识信息对应的所述用户上下文。
  26. 根据权利要求21至25中任一项所述的系统，其中，所述认证模块包括：
    判断单元，设置为采用所述用户上下文判断是否允许所述终端接入；
    反馈单元，设置为在所述判断单元输出为是时，向所述终端返回接入应答消息。
  27. 根据权利要求21所述的系统，其中，所述业务接入控制功能实体还包括：
    第二接收模块，设置为接收来自于上下文数据库的更新请求消息，其中，所述更新请求消息用于对所述用户上下文进行更新；
    转发模块，设置为将所述更新请求消息转发至已经向该业务接入控制功能实体获取所述用户上下文的相邻业务接入控制功能实体。
  28. 根据权利要求27所述的系统，其中，所述业务接入控制功能实体还包括：
    判断模块，设置为判断所述终端当前是否处于非激活状态且处于所述非激活状态的时长已经超过预设阈值；
    删除模块，设置为在所述判断模块输出为是时，直接将所述用户上下文进行删除；
    更新模块，设置为在所述判断模块输出为否时，根据所述更新请求消息对所述用户上下文进行更新。
  29. 根据权利要求20所述的系统，其中，所述业务接入控制功能实体还包括：
    第三接收模块，设置为接收来自于所述终端的业务请求消息；
    第一识别模块，设置为对所述业务请求消息进行识别，并根据所述用户上下文和终端能力信息为所述终端选择为所述终端服务的业务处理功能实体。
  30. 根据权利要求29所述的系统，其中，所述业务接入控制功能实体还包括：
    第四接收模块，设置为接收来自于所述终端的业务数据报文，并在所述业务数据报文中插入所述用户上下文；
    第二发送模块，设置为将所述业务数据报文发送至所述业务处理功能实体。
  31. 根据权利要求30所述的系统，其中，所述系统还包括：所述业务处理功能实体；
    所述业务处理功能实体包括：
    第一提取模块，设置为从所述业务数据报文中提取所述用户上下文；
    第一处理模块，设置为采用所述用户上下文和预设的业务处理逻辑对所述业务数据报文进行业务处理。
  32. 根据权利要求20所述的系统，其中，所述业务接入控制功能实体还包括：
    第五接收模块，设置为接收来自于所述终端的业务请求消息；
    第二识别模块，设置为对所述业务请求消息进行识别，并根据所述用户上下文和终端能力信息为所述终端选择为所述终端服务的业务处理功能实体；
    第三发送模块，设置为将所述用户上下文发送至所述业务处理功能实体。
  33. 根据权利要求32所述的系统，其中，所述业务接入控制功能实体还包括：
    第六接收模块，设置为接收来自于所述终端的业务数据报文，并在所述业务数据报文中插入所述用户上下文的关联信息；
    第四发送模块，设置为将所述业务数据报文发送至所述业务处理功能实体。
  34. 根据权利要求33所述的系统，其中，所述业务处理功能实体还包括：
    第二提取模块，设置为从所述业务数据报文中提取所述关联信息；
    第一获取模块，设置为根据所述关联信息获取所述上下文信息；
    第二处理模块，设置为采用所述用户上下文和预设的业务处理逻辑对所述业务数据报文进行业务处理。
  35. 根据权利要求29所述的系统，其中，所述业务接入控制功能实体还包括：
    第七接收模块，设置为接收来自于所述终端的业务数据报文，并在所述业务数据报文中插入所述用户上下文的关联信息；
    第五发送模块，设置为将所述业务数据报文发送至所述业务处理功能实体。
  36. 根据权利要求35所述的系统，其中，所述业务处理功能实体还包括：
    第三提取模块，设置为从所述业务数据报文中提取所述关联信息；
    第二获取模块，设置为根据所述关联信息从所述上下文数据库获取所述用户上下文；
    第三处理模块，设置为采用所述用户上下文和预设的业务处理逻辑对所述业务数据报文进行业务处理。
  37. 根据权利要求29所述的系统，其中，所述业务接入控制功能实体还包括：
    第四处理模块，设置为在确定无需由所述业务处理功能实体对所述业务数据报文进行业务处理的情况下，不再经由所述业务处理功能实体对所述业务数据报文进行转发。
PCT/CN2014/088868 2014-06-17 2014-10-17 通信系统、基于通信系统的接入认证方法及系统 WO2015192562A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US15/319,930 US10623405B2 (en) 2014-06-17 2014-10-17 Communication system, access authentication method and system based on communication system
EP14895450.6A EP3160190B1 (en) 2014-06-17 2014-10-17 Access authentication method and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201410271224.6A CN105307173A (zh) 2014-06-17 2014-06-17 通信网络架构、基于通信网络架构的接入认证方法及系统
CN201410271224.6 2014-06-17

Publications (1)

Publication Number Publication Date
WO2015192562A1 true WO2015192562A1 (zh) 2015-12-23

Family

ID=54934790

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2014/088868 WO2015192562A1 (zh) 2014-06-17 2014-10-17 通信系统、基于通信系统的接入认证方法及系统

Country Status (4)

Country Link
US (1) US10623405B2 (zh)
EP (1) EP3160190B1 (zh)
CN (1) CN105307173A (zh)
WO (1) WO2015192562A1 (zh)

Families Citing this family (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105307173A (zh) * 2014-06-17 2016-02-03 中兴通讯股份有限公司 通信网络架构、基于通信网络架构的接入认证方法及系统
US9992240B2 (en) * 2015-02-13 2018-06-05 Telefonaktiebolaget Lm Ericsson (Publ) Preserving S1-AP UE contexts on SCTP failover
CN107295599A (zh) * 2016-04-12 2017-10-24 中兴通讯股份有限公司 一种节点选择方法、装置及节点
CN108024296B (zh) * 2016-11-04 2020-10-09 华为技术有限公司 切换网络的方法、系统和移动性管理网元
WO2018170744A1 (en) * 2017-03-21 2018-09-27 Motorola Mobility Llc Ue context storage and context identification
CN110324868B (zh) * 2018-03-30 2021-01-08 维沃移动通信有限公司 获取用户设备上下文信息的方法和网络侧设备
JP6847892B2 (ja) 2018-06-21 2021-03-24 シャープ株式会社 Ｕｅ及び通信制御方法
WO2020104408A2 (en) * 2018-11-19 2020-05-28 Telefonaktiebolaget Lm Ericsson (Publ) Methods of operating service control nodes

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1881876A (zh) * 2005-06-17 2006-12-20 华为技术有限公司 对漫游用户进行认证的方法
CN102394818A (zh) * 2011-10-31 2012-03-28 上海顶竹通讯技术有限公司 用于小型移动核心网的分组域系统以及处理报文的方法
WO2013169161A1 (en) * 2012-05-08 2013-11-14 Telefonaktiebolaget L M Ericsson (Publ) Radio communication system, method and arrangement for use in a radio communication system

Family Cites Families (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
FI20001311A (fi) * 2000-05-31 2001-12-01 Nokia Corp Langaton paikallisverkko
WO2002009458A2 (en) * 2000-07-24 2002-01-31 Bluesocket, Inc. Method and system for enabling seamless roaming in a wireless network
US7373510B2 (en) * 2000-09-12 2008-05-13 International Business Machines Corporation System and method for implementing a robot proof Web site
JP4644998B2 (ja) * 2001-09-28 2011-03-09 ブラザー工業株式会社 認証システム、認証装置およびサービス提供装置
DE102005052263A1 (de) 2005-11-02 2007-05-03 Siemens Ag Verfahren zur dynamischen Zuteilung eines Zugangsnetzes innerhalb eines mobilen Kommunikationssystems
ES2706540T3 (es) * 2006-07-06 2019-03-29 Nokia Technologies Oy Sistema de credenciales de equipos de usuario
CN101128030B (zh) * 2006-08-16 2010-04-14 华为技术有限公司 上下文协商的方法
US8924535B2 (en) * 2008-12-23 2014-12-30 Qualcomm Incorporated Maintaining closed subscriber group information for access control
US8392973B2 (en) * 2009-05-28 2013-03-05 International Business Machines Corporation Autonomous intelligent user identity manager with context recognition capabilities
US9398517B2 (en) * 2010-01-11 2016-07-19 Blackberry Limited System and method for enabling discovery of local service availability in local cellular coverage
CN105307173A (zh) * 2014-06-17 2016-02-03 中兴通讯股份有限公司 通信网络架构、基于通信网络架构的接入认证方法及系统

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1881876A (zh) * 2005-06-17 2006-12-20 华为技术有限公司 对漫游用户进行认证的方法
CN102394818A (zh) * 2011-10-31 2012-03-28 上海顶竹通讯技术有限公司 用于小型移动核心网的分组域系统以及处理报文的方法
WO2013169161A1 (en) * 2012-05-08 2013-11-14 Telefonaktiebolaget L M Ericsson (Publ) Radio communication system, method and arrangement for use in a radio communication system

Also Published As

Publication number Publication date
US20170208063A1 (en) 2017-07-20
CN105307173A (zh) 2016-02-03
US10623405B2 (en) 2020-04-14
EP3160190A1 (en) 2017-04-26
EP3160190A4 (en) 2017-06-21
EP3160190B1 (en) 2018-11-28

Similar Documents

Publication Publication Date Title
WO2015192562A1 (zh) 通信系统、基于通信系统的接入认证方法及系统
CN111917563B (zh) 一种路由规则的配置方法及通信装置
EP3525545B1 (en) Methods for selecting session and service continuity mode in a wireless communication system
US10136363B2 (en) Facilitation of mobility management across various radio technologies
EP3657894B1 (en) Network security management method and apparatus
EP2642815A1 (en) Method for establishing and using public path and m2m communication method and system
KR20120117879A (ko) 다양한 소스 메시지 결합
EP4192184A1 (en) Pdu session establishment method, terminal device, and chip system
EP2257022A1 (en) A message distributing method, device and system
CN105681260A (zh) 传输云存储文件的方法、融合通信平台、发送端及系统
WO2017167153A1 (zh) 移动通讯系统及寻呼方法
CN108123783A (zh) 数据传输方法、装置及系统
EP4184988A1 (en) Network slicing management system, application server and terminal device
CN103796246A (zh) 数据的分流方法、装置及系统
KR100888501B1 (ko) 제어 메시지 재구성 장치, 제어 메시지 복원 장치 및 제어메시지 재구성 및 복원 방법
CN114731460B (zh) 一种多播会话的建立方法及网络设备
CN115715473A (zh) 通过改进nwdaf的功能使smf有效执行冗余传输的方法
WO2023143574A1 (zh) 设备选择的方法以及装置
WO2017054102A1 (zh) 管理用户设备的方法和设备
WO2021233235A1 (zh) 连接建立的方法、装置和系统
CN115277720A (zh) 组播组的管理方法、装置、设备及存储介质
WO2016026535A1 (en) A method, system and device for accessing data storage in a telecommunications network.
CN105516959A (zh) 终端卸载处理、终端注册处理方法及装置
CN110366209A (zh) 通信方法和装置
KR102273390B1 (ko) 네트워크 기능 통합방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 14895450

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

REEP Request for entry into the european phase

Ref document number: 2014895450

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 2014895450

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 15319930

Country of ref document: US